6652c619a75047ef38d87c00934af08a1c86a387b7a119803359703c8205f1e8

Analysis

max time kernel
88s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
24/01/2024, 11:04

Target

721156bbfc8ee5954cd2a81021085e1b.dll
Size

98KB
MD5

721156bbfc8ee5954cd2a81021085e1b
SHA1

08804c39450bf7a2c7f28e563942bb7f68d8121e
SHA256

6652c619a75047ef38d87c00934af08a1c86a387b7a119803359703c8205f1e8
SHA512

319554e0f509a52c69aab0a959cc6c06bcbd67d4fcbdd657eb4b69e24299152a7efbdcbf2a4b6119b45c07c4f16f77965eb2df7387f485c33dc77a9c5562a92b
SSDEEP

1536:g4IMnWsClk0HRNAcm++p8bPHmZ9xew9LfFKpqRXEGkaI:I1LmTpr8S/BfFKOXtka

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 1964	2976	rundll32.exe	87
PID 2976 wrote to memory of 1964	2976	rundll32.exe	87
PID 2976 wrote to memory of 1964	2976	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\721156bbfc8ee5954cd2a81021085e1b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\721156bbfc8ee5954cd2a81021085e1b.dll,#1
  2⤵
  PID:1964

memory/1964-0-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/1964-1-0x0000000000550000-0x0000000000559000-memory.dmp

Filesize
36KB

Download